opencode-skills-collection 4.1.1 → 4.1.3

package/bundled-skills/repo-native-refactor/references/semantic-risk.md

@@ -0,0 +1,187 @@
+# Semantic risk and mutation policy
+
+> Field note: when unsure between R2 and R3, I pick the higher band. Cheaper than a rollback.
+
+Risk measures the potential consequence of being wrong.
+
+Transformation safety measures confidence that a rewrite preserves meaning.
+
+They are related but separate.
+
+## R0 - mechanical
+
+Typical examples:
+
+- formatting;
+- import ordering;
+- provably unused imports;
+- obvious accidental separators;
+- deterministic syntax normalization.
+- deletion of a locally obvious comment that only restates syntax and carries no contract.
+
+Policy:
+
+Automatic mutation is acceptable when repository tooling establishes the transformation.
+
+## R1 - low structural risk
+
+Typical examples:
+
+- redundant local syntax;
+- provably dead local residue;
+- obvious no-op indirection.
+- comment or docstring cleanup whose meaning is fully established locally.
+
+Policy:
+
+Mutation is acceptable when scope is local and verification is straightforward.
+
+## R2 - contextual structural risk
+
+Typical examples:
+
+- renaming;
+- moving code;
+- extracting or inlining helpers;
+- reducing nesting;
+- consolidating duplication;
+- collapsing abstractions.
+- rewriting rationale, public documentation, test descriptions, or potentially consumed text.
+
+Policy:
+
+Inspect ownership and repository precedent first.
+
+Require a concrete maintainability or semantic benefit.
+
+Do not refactor merely because another form is prettier.
+
+## R3 - semantic risk
+
+Typical examples:
+
+- exception propagation;
+- fallbacks;
+- retries;
+- timeout;
+- caching;
+- serialization;
+- transaction ownership;
+- async lifecycle;
+- resource cleanup.
+- error or operational wording known to participate in application behavior.
+
+Policy:
+
+Never bulk-rewrite.
+
+Establish the preservation contract and meaningful behavioral verification.
+
+## R4 - critical boundary
+
+Typical examples:
+
+- authentication;
+- authorization;
+- permissions;
+- payment;
+- cryptography;
+- migrations;
+- destructive persistence;
+- concurrency-critical logic;
+- security enforcement.
+
+Policy:
+
+Maximum conservatism.
+
+When evidence is incomplete, preserve behavior and report the finding.
+
+## Transformation classes
+
+### Class A - proven mechanical
+
+May be applied unattended.
+
+The rewrite must have clear local equivalence or be an established project-tool transformation.
+
+### Class B - context sensitive
+
+Generate or consider a candidate change, then inspect and verify.
+
+Examples:
+
+- helper inline;
+- control-flow flattening;
+- rename;
+- abstraction removal;
+- context-sensitive comment or documentation changes.
+
+### Class C - semantic
+
+Requires reasoning about behavioral ownership.
+
+Examples:
+
+- changing `catch` behavior;
+- replacing fallbacks with exceptions;
+- changing retries;
+- changing transaction scope;
+- changing auth logic;
+- changing async error ownership.
+
+Never run Class C as a mass structural rewrite.
+
+## Prose risk
+
+Prose risk depends on its role, not its appearance.
+
+- Deleting a confirmed syntax restatement may be mechanical.
+- Rewriting a rationale requires repository and behavioral context.
+- Public API documentation may define a contract.
+- Error messages, logs, event fields, snapshots, stdout, and stderr may be observable behavior.
+- Comments around security, compatibility, transactions, concurrency, migrations, or lifecycle inherit the risk of the behavior they explain.
+
+Phrase matching can find candidates but cannot establish a transformation class.
+
+## Justification gate
+
+Before a significant R2+ mutation establish:
+
+**Observed problem:** What is wrong?
+
+**Consequence:** Why does it matter?
+
+**Owner:** Which layer should own the correction?
+
+**Repository evidence:** What supports that decision?
+
+**Minimal correction:** What is the smallest adequate repair?
+
+**Preservation:** What behavior must remain unchanged?
+
+**Verification:** How will the correction be checked?
+
+If the only justification is “cleaner”, “more elegant”, or “more senior”, do not perform a broad refactor.
+
+**Visible-text escalation:** if a structural change alters user- or contract-visible text
+(error messages, CLI output, logs, event fields, snapshots), escalate one band
+(R1-R2, R2-R3) and treat that text as an observable contract: preserve it exactly or
+update its consumers within scope. A green suite that asserts only exception types does
+not prove the text is safe to change.
+
+## Stop conditions
+
+Preserve rather than aggressively refactor when:
+
+- intended behavior cannot be established;
+- tests and implementation conflict without clear authority;
+- repository patterns conflict materially;
+- public contract consequences are unknown;
+- migration intent is unclear;
+- error ownership cannot be determined;
+- concurrency behavior lacks verification;
+- duplicate-looking implementations may represent independent domains;
+- unusual code may encode an unexplained historical constraint.
+
+A stop applies to the uncertain region, not necessarily the entire audit.

package/bundled-skills/repo-native-refactor/references/shared-contracts.md

@@ -0,0 +1,48 @@
+# Shared contracts
+
+These rules apply to repository development and review.
+
+## 1. Strict contract adherence (canonical wording)
+
+Preserve documented or demonstrably consumed public contracts across public interfaces,
+exported parameters, module constants, return types, errors, and serialization.
+
+- A requested behavior change may authorize a contract change only when that consequence
+  is clear from the task or from an authorized evolution. Then update affected callers,
+  tests, and living documentation within scope.
+- Otherwise preserve exact declared types. For example, never substitute or wrap an exposed
+  primitive `str` path contract with `pathlib.Path` or custom wrapper objects merely for
+  internal convenience or preference.
+- Internal intermediate representations may use appropriate helpers, provided all exposed
+  public contracts and types remain exact.
+
+## 2. Evidence hierarchy (canonical order)
+
+Use to guide investigation, not to auto-resolve material contradictions:
+
+1. User requirements and explicitly authorized scope.
+2. Documented architecture and repository guidelines.
+3. Observable public contracts and persisted schemas.
+4. Healthy sibling code within the same domain and runtime boundary.
+5. Relevant tests, schemas, callers, and dependencies.
+6. Dominant local conventions.
+7. Language and runtime idioms.
+8. Conservative, idiomatic defaults.
+
+Never treat a temporary workaround, buggy sibling, or accidental pattern as precedent.
+Never rewrite history or rubber-stamp code with stale notes. Reconcile before mutating
+the affected contract.
+
+## 3. Verification final-state rule (canonical)
+
+- Record baseline failures as: (1) pre-existing outside scope, (2) in-scope to fix,
+  (3) regressions from current changes, (4) environment errors.
+- Verify the final code state. Never use pre-cleanup results to certify modified code.
+- Never claim a check ran when it did not. Distinguish verified behavior,
+  inspection-only conclusions, and unverified assumptions.
+
+## 4. Shared judgment tests (canonical)
+
+Two questions that both skills use when the text alone under-determines the answer.
+
+A pattern counts as healthy precedent only if three things hold: code outside its original author consumes it, it does not contradict docs or contracts, and you would copy it into a new domain without apology. Popularity proves nothing; a workaround with tests and docs still fails. When two domains overlap, the owner is whoever owns the failure (who gets paged, who fixes the bug, whose reason to change fires first). Consolidate toward that owner, or leave both alone.

package/bundled-skills/repo-native-refactor/references/testing-integrity.md

@@ -0,0 +1,103 @@
+# Testing integrity
+
+Tests are evidence.
+
+They are not automatically truth.
+
+The audit must consider both:
+
+**implementation quality**
+
+and
+
+**test quality**.
+
+## Evidence confidence
+
+### High confidence
+
+Examples:
+
+- contract tests;
+- integration tests;
+- independent expected values;
+- observable end-to-end behavior;
+- regression tests tied to an externally visible failure.
+
+### Medium confidence
+
+Examples:
+
+- meaningful unit tests around public behavior;
+- isolated business-rule tests with independent fixtures.
+
+### Low confidence
+
+Examples:
+
+- expectations copied from implementation logic;
+- excessive implementation mocking;
+- tests of private structure;
+- snapshots with little semantic meaning;
+- tests asserting only that mocks were called.
+
+Higher semantic risk requires stronger evidence.
+
+If R3/R4 code has weak test evidence, reduce refactor aggressiveness.
+
+## Test-slop patterns
+
+### Tautological expectations
+
+Bad pattern:
+
+implementation computes X using formula F; test independently reproduces formula F and compares both.
+
+The test may repeat the same mistake.
+
+Prefer independent business examples or externally defined expected outcomes.
+
+### Mock theatre
+
+Mocking is not inherently bad.
+
+The problem occurs when nearly every dependency is replaced and the test validates only the configured mocks rather than meaningful behavior.
+
+Mock external or expensive boundaries when appropriate.
+
+Do not mock away the behavior being audited.
+
+### Test weakening
+
+Never make a refactor pass by:
+
+- deleting a regression case;
+- changing a precise assertion into a vague one;
+- disabling a test;
+- expanding tolerances without domain justification.
+
+If behavior intentionally changes, update tests because the contract changed, and report that behavioral change explicitly.
+
+### Implementation coupling
+
+Refactoring internals should not require widespread test rewrites when public behavior is unchanged unless repository conventions intentionally test internal units.
+
+Large test churn during a behavior-preserving refactor is a warning sign.
+
+### Test prose
+
+Test names should describe meaningful behavior using the repository's vocabulary. Do not lengthen them into narrative specifications merely to appear thorough, and do not shorten them until the behavior under test becomes ambiguous.
+
+Assertion messages, expected errors, snapshots, and golden output may constrain observable wording. Do not update them solely to accommodate stylistic rewording. If the contract intentionally changes, report it and retain independent behavioral evidence.
+
+## Verification strategy
+
+Prefer the smallest validation set that meaningfully constrains the change, then expand when risk requires it.
+
+Mechanical cleanup may need type/lint/unit checks.
+
+Structural changes may require focused unit and integration checks.
+
+Semantic and critical-boundary changes may require contract, integration, security, or end-to-end verification.
+
+Do not claim verification beyond what was actually run.

package/bundled-skills/reports-analytics/SKILL.md

@@ -0,0 +1,320 @@
+---
+name: reports-analytics
+description: 'Report register: type, source modules, owner, audience, frequency, last and next run and report link. Use for reporting governance.'
+category: business
+risk: safe
+source: self
+source_type: self
+date_added: "2026-09-26"
+author: WHOISABHISHEKADHIKARI
+tags: [sme, business, operations, database, csv, notion, sql, analyze]
+tools: []
+source_repo: WHOISABHISHEKADHIKARI/sme-ops-system-builder
+---
+
+# Reports & Analytics
+
+**What it is:** Insights hub.
+
+## Overview
+
+Works out the smallest useful **Reports & Analytics** setup for the business in front of it, then
+builds it only when asked. The default output is a short recommendation, not a
+spreadsheet. Artifacts - CSV, SQL DDL, JSON Schema, Notion mapping - are produced on
+request, from one field list so they cannot drift apart.
+
+Layer: Layer 9: Analyze. Fits: Scale stage. Table code: n/a.
+
+## When to Use This Skill
+
+- report builder
+- analytics report template
+- periodic report tracker
+- insight reports
+
+Also use it when the user says "insights hub", or describes the same process happening in a
+spreadsheet, a document or someone inboxes.
+
+Do not use it for: payroll calculation, tax filing, or legal advice. This skill produces
+empty templates only - it never holds or processes real employee or customer data.
+
+## How It Works
+
+Follow the shared execution contract. The module-specific rules below define only domain fields, decisions, calculations, and safety constraints.
+
+### Step 1 - Identify intent
+
+Read the request and pick the intent before asking anything.
+
+- "set up" or "build" or "create" -> the user wants artifacts; go to Step 2.
+- "our process is ..." or "it is in a sheet" -> the user wants to move an existing process; capture it, then Step 2.
+- "is this right" or "review" or "audit" -> the user wants a check, not a build; answer from what they share.
+- "how do I ..." -> advice question; answer directly and offer the build only if it helps.
+
+Ask only if this is the highest-value missing fact; otherwise proceed without an opener:
+
+> **Q:** Who reads the reports you produce now?
+
+### Step 2 - Ask only what is missing
+
+Skip anything the user already answered, in any earlier message. Ask the rest one at a
+time, and stop as soon as the remaining answers would not change the output.
+
+- **Readers** - Who reads them? / How often? / Monthly or weekly?
+- **Content** - Which numbers? / Comparisons included? / Any narrative?
+- **Data** - Sources available? / Who prepares it? / How long does it take?
+- **Current process** - How produced now? / Manual effort? / Is it trusted?
+- **Outcome** - What do you need? / A report set, a template or the underlying data?
+
+Never invent an answer. If the user does not know, record it as unknown and carry on.
+
+### Step 3 - Hold the internal context
+
+Hold the answers in this shape. It stays internal - it is not shown to the user unless
+they ask, and it never carries a value the user did not give.
+
+```yaml
+module: reports-analytics
+intent: null            # setup | advice | review | fix | build | convert | export
+scale: null             # Starter | Growth | Scale, only if the answer changes it
+areas:
+  "Readers": null
+  "Content": null
+  "Data": null
+  "Current process": null
+  "Outcome": null
+requested_outputs: []   # csv | sql | json | notion | xlsx - requested formats only
+confirmed_facts: []     # only what the user actually said
+open_questions: []      # the unanswered ones, in the order worth asking
+```
+
+### Step 4 - Recommend the smallest workflow
+
+If an artifact was requested, build it after resolving essential missing facts. Otherwise give a short recommendation and offer the relevant artifact.
+
+**Recommended approach:** Build a fixed monthly pack with a small set of numbers and one comment per number, and stop producing reports nobody reads.
+
+**Why this one:** Reporting effort goes into formatting, not analysis. A fixed template plus a comment per metric is the smallest useful version.
+
+**Workflow:** Data gathered → Metric calculated → Comment written → Circulated → Action noted
+
+### Step 5 - Build only on request
+
+Once the user asks for it, derive the fields from the confirmed context and emit the
+requested artifacts. For machine-readable text, keep prose outside the data; for files,
+provide a usable link. Report material validation failures or limitations separately.
+
+**A selected Notion output is rendered by `notion-manual-import`, so route the
+Notion step there.** When the user selects Notion, hand that step to
+@notion-manual-import: it holds the CSV, the property
+mapping, the import steps and the verification checklist, and it renders the Field
+Reference below instead of defining a table of its own. Do not restate the mapping
+here and do not improvise the import steps. Manual CSV and mapping outputs need no
+connection. For requested workspace changes, follow the shared contract: verify actual
+tool access and the target before writing. A user saying "connected" is not tool evidence.
+Never ask for a Notion password or token.
+
+For an Excel-compatible CSV, use UTF-8 with a byte order mark so Excel opens the
+text correctly. A CSV is not an `.xlsx` workbook; create `.xlsx` only when the user
+requests a workbook.
+A CSV carries no types, so after it, name the columns
+that need a number, date or currency format applied.
+
+```csv
+Report Name,Report Type,Source Modules,Owner,Audience,Frequency,Last Run,Next Run,Report Link,Status,Report ID
+Monthly Delivery Report,Operational,"Payments Received, Invoices & Billing",Sneha Iyer,All employees,Daily,2026-01-15 09:30,2026-01-15 09:30,https://example.com/reports/monthly-ops,Published,
+```
+
+```sql
+CREATE TABLE reports_analytics (
+  report_name VARCHAR(255),
+  report_type VARCHAR(100) NOT NULL,
+  source_modules VARCHAR(255),
+  owner VARCHAR(255),
+  audience VARCHAR(255),
+  frequency VARCHAR(100) NOT NULL,
+  last_run TIMESTAMP NOT NULL,
+  next_run TIMESTAMP NOT NULL,
+  report_link TEXT,
+  status VARCHAR(100) NOT NULL,
+  report_id SERIAL PRIMARY KEY,
+  created_at TIMESTAMP DEFAULT NOW(),
+  updated_at TIMESTAMP DEFAULT NOW()
+);
+
+CREATE INDEX idx_reports_analytics_status ON reports_analytics (status);
+```
+
+```json
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Reports & Analytics",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+      "Report Name": { "type": "string" },
+      "Report Type": { "type": "string" },
+      "Source Modules": { "type": "string" },
+      "Owner": { "type": "string" },
+      "Audience": { "type": "string" },
+      "Frequency": { "type": "string" },
+      "Last Run": { "type": "string", "format": "date-time" },
+      "Next Run": { "type": "string", "format": "date-time" },
+      "Report Link": { "type": "string", "format": "uri" },
+      "Status": { "type": "string" },
+      "Report ID": { "type": "integer" }
+  },
+  "required": [
+      "Report Type",
+      "Frequency",
+      "Last Run",
+      "Next Run",
+      "Status"
+  ]
+}
+```
+
+```markdown
+| CSV column | Notion property | Set after import |
+|---|---|---|
+| Report Name | Title | Use as the database title |
+| Report Type | Select (add options after import) | Convert to Select, add options: "Operational", "Financial", "Management", "Compliance", "Custom" |
+| Source Modules | Text | Leave as Text |
+| Owner | Text | Leave as Text |
+| Audience | Text | Leave as Text |
+| Frequency | Select (add options after import) | Convert to Select, add options: "Daily", "Weekly", "Monthly", "Quarterly", "Half Yearly", "Annual" |
+| Last Run | Date (include time) | Convert to Date (include time) |
+| Next Run | Date (include time) | Convert to Date (include time) |
+| Report Link | URL | Convert to URL |
+| Status | Select (add options after import) | Convert to Select, add options: "Scheduled", "Running", "Published", "Failed" |
+| Report ID | Text (preserve source ID) | Keep imported IDs as Text; optionally add a separate Unique ID property |
+```
+
+The rows above are documentation examples only. Emit empty templates unless the user explicitly requests examples. Money stays `currency`, dates stay `date`,
+and anything pointing at another table stays `relation`.
+
+## Field Reference
+
+| # | Field | Type | SQL | JSON Schema | Notion | CSV example |
+|---:|---|---|---|---|---|---|
+| 1 | Report Name | `text` | `VARCHAR(255)` | `string` | Text | `Monthly Delivery Report` |
+| 2 | Report Type | `select` | `VARCHAR(100)` | `string` | Select (add options after import) | `Operational` |
+| 3 | Source Modules | `text` | `VARCHAR(255)` | `string` | Text | `Payments Received, Invoices & Billing` |
+| 4 | Owner | `text` | `VARCHAR(255)` | `string` | Text | `Sneha Iyer` |
+| 5 | Audience | `text` | `VARCHAR(255)` | `string` | Text | `All employees` |
+| 6 | Frequency | `select` | `VARCHAR(100)` | `string` | Select (add options after import) | `Daily` |
+| 7 | Last Run | `datetime` | `TIMESTAMP` | `string, format: date-time` | Date (include time) | `2026-01-15 09:30` |
+| 8 | Next Run | `datetime` | `TIMESTAMP` | `string, format: date-time` | Date (include time) | `2026-01-15 09:30` |
+| 9 | Report Link | `url` | `TEXT` | `string, format: uri` | URL | `https://example.com/reports/monthly-ops` |
+| 10 | Status | `select` | `VARCHAR(100)` | `string` | Select (add options after import) | `Published` |
+| 11 | Report ID | `id` | `SERIAL PRIMARY KEY` | `integer` | Text (preserve source ID) | `(blank)` |
+
+## Select Options
+
+**Report Type**
+
+```
+Operational | Financial | Management | Compliance | Custom
+```
+**Frequency**
+
+```
+Daily | Weekly | Monthly | Quarterly | Half Yearly | Annual
+```
+**Status**
+
+```
+Scheduled | Running | Published | Failed
+```
+
+## Relations
+
+Link fields: none
+
+## Examples
+
+**Prompt**
+
+```
+We spend two days a month assembling reports nobody comments on.
+```
+
+**Context first** - one question per message, nothing already answered:
+
+> **Q:** Who reads them?
+> **A:** Directors.
+>
+> **Q:** How often?
+> **A:** Monthly.
+>
+> **Q:** How produced?
+> **A:** Manually, from accounting exports.
+
+**Recommended next step** - offered, not built:
+
+> Build a fixed monthly pack with a small set of numbers and one comment per number, and stop producing reports nobody reads.
+>
+> Workflow: Data gathered → Metric calculated → Comment written → Circulated → Action noted
+>
+> Want the CSV, SQL, JSON Schema and Notion mapping for this?
+
+## Best Practices
+
+- Build when requested; recommend and offer a build for advice-only requests.
+- One question per message. A batched intake reads as a form and gets guessed at.
+- Keep display names identical across CSV and JSON; document normalized SQL identifiers.
+- Use `relation` for anything that points at another table, `text` only for free text.
+- Money fields are `currency`, never `text`. Dates are `date`, never free text.
+- If the user requests an example row, keep it obviously fake so nobody imports it as real data.
+
+## Limitations
+
+- Empty template only. It does not compute payroll, tax, leave balances or KPIs.
+- Notion relations need both databases imported before the link column resolves.
+- Select options are a starting set. Rename them to match how the business talks.
+- No automation, reminders or sync. Those need the integration layer.
+- Does not gather data from source systems or verify accuracy.
+- Legal, tax and HR review is still required before this drives real decisions.
+
+## Security & Safety Notes
+
+- Never fill in real names, salaries, medical or banking data. Placeholders only.
+- Label example rows as synthetic, and keep bank details masked.
+- Local reads, generation commands, and validation are part of a requested artifact build.
+  External writes, messages, provisioning, and publication require authorization for that
+  action and target; existing explicit authorization does not need to be repeated.
+- If sensitive data is supplied, avoid repeating unnecessary identifiers. Use only what
+  the requested review needs; keep generated templates empty. Do not claim deletion
+  from the conversation or service storage.
+- Privacy, legal and disciplinary cases need a qualified human reviewer before anything
+  is acted on.
+
+## Common Pitfalls
+
+- **Problem:** a static mapping is described as a completed workspace build.
+  **Solution:** deliver manual mappings without a connection; claim a live change only
+  after the authorized tool operation succeeds.
+- **Problem:** asked all six questions in one message.
+  **Solution:** ask one, wait, and drop any the first answer already covered.
+- **Problem:** built a full system when one table was asked for.
+  **Solution:** build what was requested; mention the parent skill separately.
+- **Problem:** all four artifacts drift apart.
+  **Solution:** derive all four from the field list in this file, never by hand.
+- **Problem:** Notion import shows every column as Text.
+  **Solution:** that is expected. Apply the property mapping table once, after import.
+
+## Related Skills
+
+- [Module Catalog](https://github.com/sickn33/agentic-awesome-skills/blob/main/CATALOG.md) - find the relevant module, then read its skill.
+- @people-directory - the employee master record most modules link to.
+- @notification-reminder-hub - turns due dates in this module into reminders.
+
+## Reusable Prompt
+
+```
+I want to set up insights hub for my company.
+Ask me one short question at a time, and only about what I have not already told you.
+Then recommend the smallest setup that fits, and wait for me to ask before you build it.
+When I ask, output CSV, SQL DDL, JSON Schema, a Notion property mapping or an Excel workbook. Data only.
+```
+